Chapter 8

Question 1

What is a stateless protocol?

Answer 1

A stateless protocol treats each request as an independent transaction that is unable to remember information from any previous requests. This is true of HTTP.

Question 2

What is a session?

Answer 2

A semi-permanent connection between two computers (such as a client computer running a web browser and a server running Rails).

Question 3

What is a cookie?

Answer 3

A small piece of text placed on a user’s browser, which allows sessions to be maintained after the browser has been closed (i.e. the application can quickly retrieve the logged in user ID based on the provided cookie)

Question 4

How can the elements of logging in and out correspond the REST actions?

Answer 4

A login form is handled by the ‘new’ action (GET), actually logging in sends a POST request to the ‘create’ action, and logging out is handled by sending a DELETE request to the ‘destroy’ action (assuming this is a temporary session w/o cookies)

Question 5

In the following generate command for a Sessions controller, why do we create an action for ‘new’ and not ‘create’ or ‘delete’:

$ rails generate controller Sessions new

Answer 5

B/C only the ‘new’ action requires a view (we’re GETting a form). The other two do not render a view (at best they may flash a message). Since the generator makes views for all actions given as arguments, it is not necessary to generate the other two functions.

Question 6

The login page creates a session. If 2 methods (new, create) correspond to the /login url, how can we route the two methods to different controller actions?

Answer 6

Use a different HTTP method for each:

get ‘login’ => ‘sessions#new’
post ‘login’ => ‘sessions#create’
delete ‘logout’ => ‘sessions#destroy’

Question 7

What is the command to view all of the application’s routes?

Answer 7

$bundle exec rake routes

Question 8

Why does a generated controller not have access to Active Record’s functions?

Answer 8

B/C generated models inherit from Active Record, generated controllers do not.

Question 9

When creating a login page corresponding to our Sessions controller, why can’t we just pass the form_for function a variable.

Answer 9

B/C there is no corresponding model, so we cannot set an @sessions variable in the erb.

Question 10

Explain the following action:

def create
user = User.find_by(email: params[:session][:email].downcase)
if user && user.authenticate(params[:session][:password])
# Log the user in and redirect to the user’s show page.
else
# Create an error message.
render ‘new’
end
end

Answer 10

Set the user variable to a user corresponding to the values passed to the find_by method (from Active Record). The if statement makes sense b/c ‘user’ will be nil if no matching user is found, and remember that, along with false, nil is the only object in ruby that is equivalent to a boolean false.

Question 11

What is flash persistence, and what can cause it?

Answer 11

It is when a flash message continues to appear after it should have disappeared. One possible cause is that re-rendering a template with ‘render’ doesn’t count as a request, which is what would cause the flash to vanish.

Question 12

Explain the following test of a login page:

test "login with invalid information" do
    get login_path
    assert_template 'sessions/new'
    post login_path, session: { email: "", password: "" }
    assert_template 'sessions/new'
    assert_not flash.empty?
    get root_path
    assert flash.empty?
  end

Answer 12

Visit the login path.
Verify that the new sessions form renders properly.
Post to the sessions path with an invalid params hash.
Verify that the new sessions form gets re-rendered and that a flash message appears.
Visit another page (such as the Home page).
Verify that the flash message doesn’t appear on the new page.

Question 13

What is the syntax to run a single test instead of a full battery?

Answer 13

$ bundle exec rake test TEST=test/fulltestpath…/testname.rb

Question 14

What is the point of ‘flash.now’?

Answer 14

It disappears as soon as any additional request is received, avoiding flash persistence.

Question 15

T/F: helpers are made available in both their corresponding view and controller.

Answer 15

F; the helper module is included automatically in the view but not in the controller. It can be added, however, with an ‘include’ statement.

Question 16

What is the difference created by the cookie generated by the ‘session’ function vs. the ‘cookie’ function?

Answer 16

The cookie from ‘sessions’ expires when the browser is closed, the ‘cookies’ cookie persists.

Question 17

What is the point of the following code?

if @current_user.nil?
  @current_user = User.find_by(id: session[:user_id])
else
  @current_user
end

Answer 17

This prevents multiple database hits when retrieving the current user.

Question 18

Explain the following Ruby shorthand:

@foo ||= “bar”

Answer 18

Short for @foo = @foo || “bar”

Because of short circuit evaluation, the statement terminates if @foo is anything other than nil or false, leaving @foo as it is. Otherwise, it is assigned to “bar”.

Question 19

What is a fixture?

Answer 19

A way of organizing data to be loaded into the test database.

Question 20

Explain the following two test lines:

follow_redirect!

assert_select “a[href=?]”, login_path, count: 0

Answer 20

1) Visits the target page

2) Verifies that there are zero login path links on the page

Question 21

How do we delete something from a session?

Answer 21

session.delete(something)

Question 22

What kind of attack are persistent cookies vulnerable to, and what are the four methods and solutions of doing so?

Answer 22

Session hijacking, in which an attacker uses a stolen remember token to log in as a particular user. There are four main ways to steal cookies: (1) using a packet sniffer to detect cookies being passed over insecure networks (prevented with SSL) (2) compromising a database containing remember tokens (prevented by hashing the token) (3) using cross-site scripting (XSS), (prevented by Rails), and (4) gaining physical access to a machine with a logged-in user (somewhat mitigated by changing the token every time a user logs in or out and cryptographically sign sensitive information.

Question 23

How is a remember token used?

Answer 23

When the database is queried for a specific value, check that the token matches the associated hash digest for the value.

Question 24

What are the two pieces of information a cookie consists of?

Answer 24

A value and an optional ‘expires’ date.

Question 25

Explain the following code:

cookies.permanent.signed[:user_id] = user.id

Answer 25

Creates a cookie with the :user_id token and an expiration date 20 years from now (all from #permanent), and encrypts it as a signed cookie (#signed)

Question 26

Explain the following if statement:

if (user_id = session[:user_id])

Answer 26

user_id will evaluate to the :user_id of the session, so this if statement will be false only if :user_id does not exist (returns nil)